Did I undertand it properly that they was able identify connections from tor browser to onion service?